Description
Multiple buffer overflows in Hypermail 2 before 2.1.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code (1) via a long attachment filename that is not properly handled by the hypermail executable, or (2) by connecting to the mail CGI program from an IP address that reverse-resolves to a long hostname.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | hypermail | 2.1.3-2.0 | DSA-248 |
Advisories 1
- DSA-248 hypermail - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- hypermail-mail-attachment-bo(11157) vdb-entry
- 6690 vdb-entry
- 8030 third-party-advisory
- 20030127 Hypermail buffer overflows mailing-list
- 20030126 Hypermail buffer overflows mailing-list
- hypermail-long-hostname-bo(11158) vdb-entry
- DSA-248 vendor-advisory
- 6689 vdb-entry